Managed Detection and Response cover Giacomo Lanzi

Managed Detection and Response: a new preventive approach

Estimated reading time: 6 minutes

The constant use of communications over the network in a corporate context makes it essential to take precautions for computer security. As we have seen on other occasions, the dangers can come from different fronts: phishing , ransomware , data breach , etc. The implementation of new strategies such as Managed Detection and Response allows to mitigate risks and identify potential threats.

In this article, we’ll take a closer look at this new approach, focusing on advanced threats and the benefits of this new approach for businesses.

Managed Detection and Response security

Advanced-persistent-threats and SIEMs

A search of CardinalOPS , carried out on Fortune 1000 companies, highlights how companies using a system SIEM , however, encounter problems of cyber attacks. This is due, as Yair Manor, co-founder of CardinalOPS, in part to the visibility . Basically, the big companies have no real knowledge of the extent of their infrastructures and this leaves some openings from which it is possible to enter.

Systems with SIEM implementation, although they guarantee good IT security, are often mishandled by internal company technicians. Research shows that only 16% of standard threat protection techniques are actually applied by employees . Interesting data that show how an average of 25% of SIEM rules are violated or even never activated by security officers. It is therefore not easy to determine what are the best criteria to apply once the cyber attacks have occurred.

Among the 1000 companies surveyed, many of them invest considerable capital, in the billions of dollars, in order to identify the greatest number of correlations and events related to the corporate attack.

The process of constant improvement of SIEM systems underlines how this can be a real solution with a centralization and rationalization of the flow of incidents. In addition to choosing an effective security system, it is essential to have experienced technicians to be able to use the tools correctly.

Managed Detection Services & amp; Response: what are they

As noted in the previous lines, a SIEM-based system is effective, but not foolproof . In a situation where there is uncertainty of reliability, a new strategy is born to mitigate the risk. Specifically, there was the introduction of the Security Orchestration, Automation & amp; Response (SOAR) in SOCs, capable of automating repetitive workloads and detecting false positives. We also talked about it in a specific article in which we analyzed the advantages of this approach.

As it is easy to deduce, not all companies have implemented an efficient SOC system in their company, although it is now possible to find “ as a Service ” versions such as what we offer .

In this context, where the ability to identify the anomalous threat in the shortest possible time is essential, an innovative strategy is placed: Managed Detection & amp; Response (MDR) .

This service strategy is about identifying the threat as quickly as possible and containing it before it reaches its maximum level . There is therefore a change of approach due to the need to monitor potential threats around the clock. This is possible with a dedicated service capable of carrying out surveys 24 hours a day and for the whole week .

This approach implements an advanced, intelligent analysis aimed at reporting and solving the problem. Companies that choose our SOCaaS can take advantage of a service capable of speeding up the collection process and data analysis, freeing them from potential threats .

It should also be considered that the automation of the collection and analysis phases lowers maintenance prices for the company’s IT department. An advantage that cannot be ignored, offered by the decentralization of security services, such as SOCaaS from SOD.

The advantages of MDR

In order to fully understand the potential of Managed Detection and Response, it is advisable to analyze the concrete benefits that individuals and companies find in this service.

Organizations using an MDR solution can immediately reduce detection time (and therefore response time). Threats can be identified in minutes, giving you the ability to take immediate action.

But reducing time-to-detect from months to minutes isn’t the only advantage of an MDR. Companies can also:

  • Increase resilience to potential attacks by optimizing the security configuration and eliminating rogue systems .
  • Identify and stop hidden and sophisticated threats through a continuous threat hunting .
  • Respond to threats more effectively and restore endpoints to a known state through guided response and managed remediation.
  • Redirect personnel from response work to reactive and repetitive incidents towards more strategic projects.

The incidence of ransomware

Companies know very well that one of the most difficult problems to eradicate within the corporate IT context, is the ransomware . A Managed Detection and Response strategy can defeat these threats and better manage phishing campaigns. Although employees may have a good background in cybersecurity, in many cases they are prone to trivial errors . In this regard, we recommend that you evaluate our ethical phishing service, to focus on training as a weapon against phishing .

Companies that do not have a dedicated team, in many cases manage cybersecurity with superficiality, belittling and underestimating the simplest cyber attacks. Being able to preventively eliminate a potential problem is a benefit that should not be underestimated, especially if you are bound to a continuous flow of incoming and outgoing data.

Managed Detection and Response cover

Prevention

The MDR strategy aims to prevent attacks and not to eradicate them once they are unassailable. Unfortunately, dealing with a cyber attack is particularly expensive, not only due to the difficulty of recovering the lost information, but also to restore its correct functioning.

A prevention service is the ideal answer to free yourself from potential dangers , protecting not only your company, but also the employees who can become victims in turn.

Conclusions: a concrete solution

Not all MDR services are identical to each other and it is advisable to rely on those who have been working for years and are committed to making this technology more and more effective.

The services offered by SOD, such as SOCaaS, guarantee an ideal solution for every company . Thanks to the introduction of state-of-the-art security software and solutions, SOD is in a position to offer a service aimed at the best possible prevention for corporate protection.

Customization and the choice of a dedicated service allow you to better manage company production. In an age when it is essential to protect yourself from cyber threats, a service dedicated to prevention is the smartest solution.

If you want to know how our solutions can help your business, do not hesitate to contact us, we will be happy to answer any questions.

Useful links:

SOAR: coordination for cyber security

SOAR: what it is and how it can be useful for companies

What is threat intelligence?

Use cases of a SOCaaS for companies part 2

Share


RSS

More Articles…

Categories …

Tags

RSS darkreading

RSS Full Disclosure

  • Business Logic Flaw and Username Enumeration in spa-cartcmsv1.9.0.6 June 16, 2024
    Posted by Andrey Stoykov on Jun 15# Exploit Title: Business Logic Flaw and Username Enumeration in spa-cartcmsv1.9.0.6 # Date: 6/2024 # Exploit Author: Andrey Stoykov # Version: 1.9.0.6 # Tested on: Ubuntu 22.04 # Blog: https://msecureltd.blogspot.com/2024/04/friday-fun-pentest-series-5-spa.html Description - It was found that the application suffers from business logic flaw - Additionally the application is vulnerable […]
  • APPLE-SA-06-10-2024-1 visionOS 1.2 June 12, 2024
    Posted by Apple Product Security via Fulldisclosure on Jun 11APPLE-SA-06-10-2024-1 visionOS 1.2 visionOS 1.2 addresses the following issues. Information about the security content is also available at https://support.apple.com/HT214108. Apple maintains a Security Releases page at https://support.apple.com/HT201222 which lists recent software updates with security advisories. CoreMedia Available for: Apple Vision Pro Impact: An app may be […]
  • CyberDanube Security Research 20240604-0 | Multiple Vulnerabilities in utnserver Pro/ProMAX/INU-100 June 9, 2024
    Posted by Thomas Weber via Fulldisclosure on Jun 09CyberDanube Security Research 20240604-0 ------------------------------------------------------------------------------- title| Multiple Vulnerabilities product| SEH utnserver Pro/ProMAX / INU-100 vulnerable version| 20.1.22 fixed version| 20.1.28 CVE number| CVE-2024-5420, CVE-2024-5421, CVE-2024-5422 impact| High homepage| https://www.seh-technology.com/...
  • SEC Consult SA-20240606-0 :: Multiple critical vulnerabilities in Kiuwan SAST on-premise (KOP) & cloud/SaaS & Kiuwan Local Analyzer (KLA) June 9, 2024
    Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Jun 09SEC Consult Vulnerability Lab Security Advisory < 20240606-0 > ======================================================================= title: Multiple critical vulnerabilities product: Kiuwan SAST on-premise (KOP) & cloud/SaaS Kiuwan Local Analyzer (KLA) vulnerable version: Kiuwan SAST
  • Blind SQL Injection - fengofficev3.11.1.2 June 9, 2024
    Posted by Andrey Stoykov on Jun 09# Exploit Title: FengOffice - Blind SQL Injection # Date: 06/2024 # Exploit Author: Andrey Stoykov # Version: 3.11.1.2 # Tested on: Ubuntu 22.04 # Blog: https://msecureltd.blogspot.com/2024/05/friday-fun-pentest-series-6.html Steps to Reproduce: 1. Login to application 2. Click on "Workspaces" 3. Copy full URL 4. Paste the HTTP GET request into […]
  • Trojan.Win32.DarkGateLoader (multi variants) / Arbitrary Code Execution June 9, 2024
    Posted by malvuln on Jun 09Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2024 Original source: https://malvuln.com/advisory/afe012ed0d96abfe869b9e26ea375824.txt Contact: malvuln13 () gmail com Media: x.com/malvuln Threat: Trojan.Win32.DarkGateLoader (multi variants) Vulnerability: Arbitrary Code Execution Description: Multiple variants of this malware look for and execute x32-bit "urlmon.dll" PE file in its current directory. Therefore, we can...
  • SQL Injection Vulnerability in Boelter Blue System Management (version 1.3) June 9, 2024
    Posted by InfoSec-DB via Fulldisclosure on Jun 09Exploit Title: SQL Injection Vulnerability in Boelter Blue System Management (version 1.3) Google Dork: inurl:"Powered by Boelter Blue" Date: 2024-06-04 Exploit Author: CBKB (DeadlyData, R4d1x) Vendor Homepage: https://www.boelterblue.com Software Link: https://play.google.com/store/apps/details?id=com.anchor5digital.anchor5adminapp&hl=en_US Version: 1.3 Tested on: Linux Debian 9 (stretch), Apache 2.4.25, MySQL >= 5.0.12 CVE:...
  • CyberDanube Security Research 20240528-0 | Multiple Vulnerabilities in ORing IAP-420 May 30, 2024
    Posted by Thomas Weber via Fulldisclosure on May 29CyberDanube Security Research 20240528-0 ------------------------------------------------------------------------------- title| Multiple Vulnerabilities product| ORing IAP-420 vulnerable version| 2.01e fixed version| - CVE number| CVE-2024-5410, CVE-2024-5411 impact| High homepage| https://oringnet.com/ found| 2024-01-19 by| T. Weber...
  • HNS-2024-06 - HN Security Advisory - Multiple vulnerabilities in Eclipse ThreadX May 30, 2024
    Posted by Marco Ivaldi on May 29Hi, Please find attached a security advisory that describes multiple vulnerabilities we discovered in Eclipse ThreadX (aka Azure RTOS). * Title: Multiple vulnerabilities in Eclipse ThreadX * OS: Eclipse ThreadX < 6.4.0 * Author: Marco Ivaldi * Date: 2024-05-28 * CVE IDs and severity: * CVE-2024-2214 - High - […]
  • SEC Consult SA-20240527-0 :: Multiple vulnerabilities in HAWKI didactic interface May 28, 2024
    Posted by SEC Consult Vulnerability Lab via Fulldisclosure on May 27 SEC Consult Vulnerability Lab Security Advisory < 20240527-0 > ======================================================================= title: Multiple vulnerabilities product: HAWKI (Interaction Design Team at the University of Applied Sciences and Arts in Hildesheim/Germany) vulnerable version: 1.0.0-beta.1, versions before commit 146967f     fixed version: Github commit 146967f...

Customers

Newsletter

{subscription_form_1}